Focus Group 1B Cybersecurity Dr. Bill Hancock, CISSP Cable and Wireless America FG1B Chair

Charter of FG1B Cybersecurity Generate Best Practices for cybersecurity –Telecommunications sector –Internet services Deliverables –December 2002 – prevention –March 2003 – restoration New team, very little previous material to use for a base or as a guideline

Composition and Organization Made up predominantly of Chief Security Officers or equivalent at most telecom companies in the U.S. as well as selected Subject Matter Experts (SMEs) Members include various U.S. Government agencies such as DoC, DoD, DoJ, FCC, Federal Reserve, etc. Group is divided into 10 working teams, each with a team leader

Working Efforts Focus is on “gap filling” for cybersecurity Best Practices (BP) –Find and use existing BPs for cybersecurity –Identify where there are gaps in completeness –Create master list of existing BPs 75+ focus areas identified in initial meetings Each team meets at the same time each week via conference call Working BPs are entered into an agreed-upon template that all teams use There is a process in-place to collect, share and provide documents between team members

Network Security Framework (Based on Bell Labs model) Access Management Infrastructure Security Application Security Service Security End User Plane Control Plane Management Plane THREATS VULNERABILITIES 8 Security Dimensions ATTACKS Data SecurityCommunication SecurityIntegrityAvailabilityPrivacy Interruption Fabrication Interception Modification Authentication Non-repudiation * Proposed to the ITU as a standard.

FG1B Cybersecurity Teams Fundamentals Transport OAM&P (operations, administration, maintenance and provisioning AAA (authentication, accounting, audit) Services Personnel Users Architecture Incidents

Application Security Service Security Infrastructure Security End- User Plane Control Plane Mgmt Plane Personnel OAM&P Services Users Transport Apply to all: AAA Fundamentals Architectures Incidents Security Framework Mapping

FG1B Project Management First consolidation of BPs is in mid October First major edit process in early November Final assembly for FG1B cybersecurity prevention deliverable in mid November Deliverable for cybersecurity prevention on December 6, 2002 Edit process for FG1B restoration in January 2003 Deliverable for cybersecurity restoration in March 2003

Expectations on Deliverables Cybersecurity technologies are being implemented to varying degrees BPs identified will be evaluated for factors affecting implementation BPs will recommend “what”, not “how” to implement BPs for cybersecurity